Security Bulletin: Apache CXF Vulnerability Affects IBM Global Mailbox (CVE-2021-22696)

Summary

Security vulnerability have been Identified In Apache CXF library shipped with IBM Global Mailbox.

Vulnerability Details

CVEID:CVE-2021-22696
**DESCRIPTION:**Apache CXF is vulnerable to a denial of service, caused by improper validation of request_uri parameter by the OAuth 2 authorization service. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to cause a denial of service condition on the authorization server.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/199335 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Remediation/Fixes

Refer to the following security bulletins for vulnerability details and information about fixes addressed by Apache CXF which is/are shipped with Global Mailbox.

Principal Product and Version(s)

|

Affected Supporting Product and Version

|

Affected Supporting Product Security Bulletin

—|—|—

Global Mailbox version 6.1.0.3

|

Apache CXF Version 3.4.3

|

See links below

6.1.0.3 is now available on Fix central.

Sterling B2B Integrator

https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EOther%20software&product=ibm/Other+software/Sterling+B2B+Integrator&release=6.1.0.2&platform=All&function=fixId&fixids=6.1.0.3-OtherSoftware-B2Bi-All&includeSupersedes=0

Sterling File Gateway

https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EOther%20software&product=ibm/Other+software/Sterling+File+Gateway&release=6.1.0.2&platform=All&function=fixId&fixids=6.1.0.3-OtherSoftware-SFG-All&includeSupersedes=0

Certified Container edition images and Helm charts are now available for download from IBM Entitled Registry (ER) and IBM public chart repository, respectively.

IBM Sterling B2B Integrator V6.1.0.3

• Certified Container Image

cp.icr.io/cp/ibm-b2bi/b2bi:6.1.0.3

• Helm Chart

<https://github.com/IBM/charts/blob/master/repo/ibm-helm/ibm-b2bi-prod-2.0.3.tgz&gt;

IBM Sterling File Gateway V6.1.0.3

• Certified Container Image

cp.icr.io/cp/ibm-sfg/sfg:6.1.0.3

• Helm Chart

<https://github.com/IBM/charts/blob/master/repo/ibm-helm/ibm-sfg-prod-2.0.3.tgz&gt;

Workarounds and Mitigations

None